Browsed by
Tag: firewall

FortiGate HA Cluster Management IP – In Band Method v6

FortiGate HA Cluster Management IP – In Band Method v6

This article describes an option for managing a FortiGate HA cluster. Why is this important? Ideally, you want to make sure you have IP access to both the Active and Standby FortiGate firewalls separately from the combined management IP address. This gets important when you have to do things like a remote upgrade. This method will give you a separate management IP address on both the primary and standby FortiGate firewall. These IP addresses will be on the same network…

Read More Read More

Cisco ASA Ping TCP troubleshooting command

Cisco ASA Ping TCP troubleshooting command

We’ve all used ping to test basic connectivity and we all know that command sends ICMP packets and waits for replies. On Cisco ASA’s you can also use an enhanced version of this command to send any TCP packet instead of just ICMP. This is awesome for troubleshooting purposes and verifying remote services/ports are up, running and reachable. It’s also a great trick to force traffic over a VPN connection to bring a tunnel up from the ASA! Let’s assume…

Read More Read More

Cisco ASA Active/Active Failover

Cisco ASA Active/Active Failover

Cisco ASA Active/Active failover requires two identical Cisco ASA appliances talking to each other through a dedicated failover link and a dedicated stateful link (these can be the same interface). With Active/Active failover both appliances will carry traffic. Failover contexts and failover groups need to be created, the failover group is then applied to the Primary or Secondary ASA appliance. Example configuration parameters:ASA1 & ASA2 are the firewall names being used. Make sure the interfaces being used for the failover…

Read More Read More

Cisco ASA Active/Standby Failover

Cisco ASA Active/Standby Failover

Active/Standby failover enables you to use a standby ASA to take over for a failed unit. When the active unit fails it changes to the standby state while the standby unit changes to the active state. The unit that becomes active assumes the IP addresses and the MAC addresses of the failed unit and starts passing traffic. In Active/Standby failover, failover occurs on a unit basis, even on systems running in multiple context mode, you can’t failover individual contexts. Aside…

Read More Read More

FortiGate as a DNS slave to a Windows AD DNS Master v5.4

FortiGate as a DNS slave to a Windows AD DNS Master v5.4

This post goes over how to setup a FortiGate firewall as a slave DNS server to a Windows DNS master.  This is a great feature to enable for branch offices or even as basic redundancy to a single Windows DNS server. Starting on the Windows DNS Server: Launch DNS Manager Double click on the zone you want to replicate and locate the SOA record and edit it. Go to the Zone Transfer tab and enable zone transfers.  You can leave…

Read More Read More

FortiGate Agent Based FSSO AD Integration v5.4

FortiGate Agent Based FSSO AD Integration v5.4

If you want to report on user Internet usage and possibly even define access rules based on your Active Directory groups this document is for you.  We’ll install the FSSO Collector Agent in basic mode, identify the groups we are interested in and setup the FortiGate. The FSSO Collector will monitor the Windows security logs on your domain controller for log on and log off events, these events contain the IP address of the computer that logged on or off…

Read More Read More

FortiGate Geo Blocking v5.4

FortiGate Geo Blocking v5.4

I’m frequently asked to block users from accessing certain countries and it can help prevent exploits if your users have no business connecting to some of these countries.  This is called Geo Blocking and it’s pretty easy to setup. Setup address object for the country you want to block Navigate to Policy & Objects > Addresses and click Create New Address Enter the name of the country in question Change the Type to Geography Change the Country to the country…

Read More Read More

FortiGate Block Website v5.4

FortiGate Block Website v5.4

This post shows you how to block an individual website with a static URL filter. Navigate to Security Profiles > Web Filter Scroll down to Static URL filter and enable URL Filter (if it’s not already) Click Create Enter the url you want to block.  I’m using facebook.com for this example and since I want to block all things facebook.com I’m making this a Wildcard block and using *facebook.com for the entry.  Click OK Make sure you have an outbound…

Read More Read More

FortiGate Dual ISP Failover both active v5.4

FortiGate Dual ISP Failover both active v5.4

The premise.  You have a FortiGate and you have two ISP connections.  Maybe the speeds aren’t that close together and one of them is really just for failover so load balancing is out but you want BOTH WAN connections to respond from the outside. It’s pretty straight forward.  Configure your IP addressing on both WAN interfaces.  Let’s assume WAN1 is going to be the primary connection. The secret sauce is in the Distance and Priority for your static routes.  You…

Read More Read More

Cisco FirePOWER Management Center Alerting – v6

Cisco FirePOWER Management Center Alerting – v6

If you want to be notified of system alerts without having to stare at the dashboard then you need to configure an email server and external alerting. Configure Email Notification Navigate to System > Configuration > Email Notification Enter the Mail Relay Host, the port number, the encryption method, the from address and the authentication settings and click Save. Make sure to click Test Mail Server Settings to make sure they are working properly before proceeding.  

Cisco ASA5500-X FirePOWER Preparation v6

Cisco ASA5500-X FirePOWER Preparation v6

To upgrade an ASA’s FirePOWER module to version 6 and get it ready to be integrated into FirePOWER Management Center is a bit of a process but thankfully most of it isn’t production impacting. First a few prerequisites. The ASA must have a SSD drive installed and functional.  Do a show inventory from the CLI to make sure one is found before you get started, if you have a drive installed but it’s not showing up try rebooting the ASA….

Read More Read More

Cisco FirePOWER Management Center v6 – Adding Licenses

Cisco FirePOWER Management Center v6 – Adding Licenses

This will cover Classic Licensing, not Smart Licensing for FirePOWER features.  You’ll receive your PAK code from Cisco either electronically or on a paper card.  From there you can goto https://cisco.com/go/license to register it and get the actual .LIC file. If you haven’t purchased a license yet, you can get a demo license from Cisco by working with your sales engineer. Before you head over there you will need the License Key from the FirePOWER Management Center since that’s where…

Read More Read More

Cisco FirePOWER Management Center AD Integration v6

Cisco FirePOWER Management Center AD Integration v6

You have FirePOWER Management Center all fired up and configured and you are getting lots of information but rather then seeing what user is doing what, you are just getting source computer IP addresses.  You can tie FirePOWER into Active Directory to report on actual users as well as being able to create policies based on AD users.  This lets you get much more granular with your approach. There are two ways to accomplish this, active authentication and passive authentication….

Read More Read More

Cisco FirePOWER Management Center v6 – Initial Installation

Cisco FirePOWER Management Center v6 – Initial Installation

This will review deploying the Cisco FirePOWER Management Center on ESXi.  The Management Center makes it possible to manage multiple FirePOWER devices from a central server, allowing you to scale up more efficiently. Before we get started, a few prerequisites.  Make sure you have a VMware host (ESXi or ESX).  You will need capacity on this host for 8GB RAM, 4 vCPU’s and 250GB storage (thick provisioned) for the FirePOWER Management Center VM.  You can deploy this thin provisioned if…

Read More Read More